Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-33707 |
critical | 9.8 | 0.0043 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password r | |
CVE-2026-13019 |
critical | 9.8 | 0.0085 | 2026-07-07 | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing aut | |
CVE-2026-13020 |
critical | 9.8 | 0.0047 | 2026-07-07 | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions | |
CVE-2026-12571 |
critical | 9.8 | 0.0327 | 2026-08-11 | An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeov | |
CVE-2026-61967 |
critical | 9.8 | 0.0048 | 2026-08-13 | Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. | |
CVE-2026-66691 |
critical | 9.8 | 0.0048 | 2026-08-13 | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | |
CVE-2026-77264 |
critical | 9.8 | 0.0071 | 2026-08-21 | The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin fo | |
CVE-2026-53595 |
critical | 9.4 | 0.0194 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version | |
CVE-2026-56081 |
critical | 9.3 | 0.0043 | 2026-06-19 | Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and cont | |
CVE-2026-116214 |
critical | 9.3 | 0.0046 | 2026-10-26 | MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthe | |
CVE-2026-34751 |
critical | 9.1 | 0.0031 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1 in @pa | |
CVE-2026-18363 |
critical | 9.1 | 0.0048 | 2026-07-30 | A logic vulnerability in the password reset token validation routine implemented by osTicket in vers | |
CVE-2026-18963 |
critical | 9.1 | 0.0468 | 2026-08-18 | A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core | |
CVE-2026-63159 |
critical | 9.1 | 0.0033 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability tha | |
CVE-2026-72772 |
high | 8.9 | 0.0045 | 2026-08-11 | n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed | |
CVE-2026-35676 |
high | 8.8 | 0.0030 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password | |
CVE-2026-86055 |
high | 8.7 | 0.0040 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2. | |
CVE-2026-119127 |
high | 8.6 | — | 2026-10-29 | ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that a | |
CVE-2026-56308 |
high | 8.4 | 0.0031 | 2026-07-12 | Capgo before 12.128.2 allows email address changes without requiring current password re-authenticat | |
CVE-2026-58202 |
high | 8.3 | 0.0024 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-70175 |
high | 8.1 | 0.0073 | 2026-10-13 | Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a | |
CVE-2026-45013 |
high | 8.1 | 0.0031 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29 | |
CVE-2026-94380 |
high | 8.1 | 0.0032 | 2026-10-26 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS all | |
CVE-2026-46894 |
high | 8.0 | 0.0017 | 2026-06-17 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Pag | |
CVE-2026-60646 |
high | 8.0 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-60648 |
high | 8.0 | 0.0018 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-60650 |
high | 8.0 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-61181 |
high | 7.6 | 0.0027 | 2026-07-21 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply | |
CVE-2026-60658 |
high | 7.5 | 0.0016 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-40585 |
high | 7.4 | 0.0026 | 2026-04-21 | blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is ini | |
CVE-2026-61049 |
high | 7.1 | 0.0030 | 2026-07-21 | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Int | |
CVE-2026-115973 |
medium | 6.9 | 0.0028 | 2026-10-24 | A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the fun | |
CVE-2026-46347 |
medium | 6.8 | 0.0025 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-46346 |
medium | 6.5 | 0.0033 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-61143 |
medium | 6.4 | 0.0031 | 2026-07-21 | Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communic | |
CVE-2026-53904 |
medium | 6.3 | 0.0034 | 2026-07-01 | MCO is vulnerable to Account Denial of Service due to improper implementation of password reset func | |
CVE-2026-15479 |
medium | 5.5 | 0.0047 | 2026-07-12 | A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function chang | |
CVE-2026-34198 |
medium | 5.3 | 0.0017 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-62517 |
medium | 5.3 | 0.0016 | 2026-07-21 | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Int | |
CVE-2026-64635 |
medium | 5.3 | 0.0029 | 2026-07-30 | Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provid | |
CVE-2026-62486 |
medium | 5.0 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Int | |
CVE-2026-7554 |
low | 2.9 | 0.0110 | 2026-05-01 | A vulnerability was determined in D-Link M60 up to 1.20B02. Affected by this issue is some unknown f | |
CVE-2026-19361 |
low | 2.9 | 0.0044 | 2026-08-09 | A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the fil |